CVE-2026-55807
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
SSRF vulnerability in Drupal core allows an attacker to send requests from the server to internal network resources. The issue affects multiple Drupal versions including 10.5.x, 10.6.x, 11.2.x, 11.3.x, and older branches 11.0.x and 11.1.x.
Risk Assessment
An attacker can exploit this vulnerability to scan internal networks, access sensitive data, or launch attacks against other systems within the organization's infrastructure.
Recommendation
Immediately update Drupal core to the latest patched version. In the meantime, consider implementing WAF rules to block suspicious SSRF requests.
Original NVD description (English source)
Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal core allows Server Side Request Forgery. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*.